Kaspersky on Duqu: same author, but wider industrial espionage agenda
According to the Moscow-headquartered IT security vendor, the striking parallels between the two malicious programs suggest they were either both written by the same group of people or that the Stuxnet source code – which has not been made publicly available – was used in its creation.
The bad news, however, is that there are significant differences between the two programs and, says Kaspersky, Duqu contains no functionality targeting industrial systems, as was the case with Stuxnet.
”As well as the main module, the Duqu files include an additional trojan-spy module capable of intercepting data entered via the keyboard, capturing screenshots, gathering information about the system etc”, says the report, adding that this all suggests industrial espionage is its primary aim. Alexander Gostev, Kaspersky’s chief security expert, said that further investigation has managed to identify new Duqu victims, primarily in Iran, which once again echoes the parallels with Stuxnet.
